Article Number
000039768
Applies To
RSA Product Set: RSA NetWitness Platform
RSA Version/Condition: 11.5.x, 11.6.x
Platform: CentOS
O/S Version: 7
Issue
NetWitness keeps running out swap file space, how to create more swap?
The default NetWitness swap partition 4GB keeps running low.
Have tried everything to reduce the memory usage on the NetWitness appliance, but need more swap space.
Resolution
Swap space can take the form of either a dedicated swap partition or a swap file.
The default NetWitness install creates a 4GB swap partition.
Can create an additional swap file on a mount with free disk space and then add this file as an extension to the existing swap partition.
If available, creating the new swap file on an SSD mount will provide better performance than on a hard disk mount.
Recommend creating a 4GB swap file, and no more than double the physical memory size.
Swap space will always perform slower than physical memory.
Creating a swap file
- Create a 4GB file that will be used as a swap.
fallocate -l 4G {path}/swapfile
For example:
fallocate -l 4G /home/do-not-delete/swapfile
Or if the above command fails.
dd if=/dev/zero of={path}/swapfile bs=1K count=4M
Substitute {path}/swapfile with a suitable path and filename.
- Give the created swap file read and write permission to the root user.
chmod 600 /home/do-not-delete/swapfile
- Format the file as a swap file.
mkswap /home/do-not-delete/swapfile
- Add the new swap file as an addition to the existing swap partition.
swapon /home/do-not-delete/swapfile
- Add the new swap file to the /etc/fstab file.
Edit the /etc/fstab file and add the following line.
/home/do-not-delete/swapfile swap swap defaults 0 0
- Confirm the new swap file is active.
[root@NW ~]# swapon --show
NAME TYPE SIZE USED PRIO
/dev/dm-11 partition 4G 4G -2
/home/do-not-delete/swapfile file 4G 4G -3
[root@NW ~]# free -h
total used free shared buff/cache available
Mem: 33G 32G 239M 12M 446M 316M
Swap: 8.0G 8.0G 76K
Notes
Remove the swap file
1. Stop using the swap file
swapoff {path}/swapfileFor example:
swapoff /home/do-not-delete/swapfile
Substitute
{path}/swapfile with a suitable path and filename.
2. Delete the swap file to free up the disk space
rm /home/do-not-delete/swapfile
3. Remove the swap file entry from the /etc/fstab file
Edit the /etc/fstab file and remove the following line.
/home/do-not-delete/swapfile swap swap defaults 0 0
6. Confirm the swap file is removed
[root@NW ~]# swapon --show
NAME TYPE SIZE USED PRIO
/dev/dm-13 partition 4G 0B -2
[root@NW ~]# free -h
total used free shared buff/cache available
Mem: 33G 11G 13G 129M 7.9G 21G
Swap: 4.0G 0B 4.0G